TutuApp : explanations and risks?

[nicopulse]

Hello,

I'm looking for explanations about TutuApp. This app is an non official alternative App Store very simple to install without jailbreak on iOS and very functional.

1) The certificates used to trust this application and used to install it on iOS (Winner Media Co. Certificate + Beifjing Wanzhao Technology Co. LTD Certificate), with "enterprise applications" appellation, have not been revoked by Apple at this date (iOS 10.3.1) : so, this application can be installed with 3 clicks from Safari!
Why Apple tolerates this?

2) Is there a serious evaluation about risks for users of this application ? The binary code is therefore not inspected by Apple. Hence 2 questions :

• can an enterprise application bypass the authorization checking framework if a user installs it (contacts access, photos, micro, camera, data connection, etc.)
• can an enterprise application uses iOS private API ?

Thank you for bringing objective information, based on your experience as an iOS developer or expert user, but not on legal part please (because law changes with countries, and I want to address only technical issues here).